Verify alternative server certificate validity for origin.

net/http/http_stream_factory_impl_job.h

Index: net/http/http_stream_factory_impl_job.h
diff --git a/net/http/http_stream_factory_impl_job.h b/net/http/http_stream_factory_impl_job.h
index 27c5f00ec0fafa39f80396c0413b239326e30e7a..6d1d86a5f4dd73af12ce827a50f0b28cd26c85d8 100644
--- a/net/http/http_stream_factory_impl_job.h
+++ b/net/http/http_stream_factory_impl_job.h
@@ -140,6 +140,39 @@ class HttpStreamFactoryImpl::Job {
     STATUS_SUCCEEDED
   };
 
+  // Wrapper class for SpdySessionPool to guarantee certificate requirements for
+  // SpdySessions.
+  class ValidSpdySessionPool {
+   public:
+    ValidSpdySessionPool(HttpNetworkSession* session_,
+                         GURL& origin_url,
+                         bool is_spdy_alternate);
+
+    base::WeakPtr<SpdySession> FindAvailableSession(const SpdySessionKey& key,
+                                                    const BoundNetLog& net_log,
+                                                    bool* is_valid);
+
+    base::WeakPtr<SpdySession> CreateAvailableSessionFromSocket(
+        const SpdySessionKey& key,
+        scoped_ptr<ClientSocketHandle> connection,
+        const BoundNetLog& net_log,
+        int certificate_error_code,
+        bool is_secure,
+        bool* is_valid);
+
+   private:
+    // Returns true if |spdy_session| has an associated SSL certificate with is
+    // valid for |origin_url_|, or if this requirement does not apply because
+    // the Job is not a SPDY alternate job, or |spdy_session| is null, or the
+    // hostnames match.
+    bool IsAlternativeCertificateValidForOrigin(
+        base::WeakPtr<SpdySession> spdy_session);
+
+    HttpNetworkSession* const session_;
+    const GURL origin_url_;
+    const bool is_spdy_alternate_;
+  };
+
   void OnStreamReadyCallback();
   void OnWebSocketHandshakeStreamReadyCallback();
   // This callback function is called when a new SPDY session is created.
@@ -327,6 +360,9 @@ class HttpStreamFactoryImpl::Job {
   // preconnect.
   int num_streams_;
 
+  // Wrapper class for SpdySessionPool to enforce certificate requirements.
+  scoped_ptr<ValidSpdySessionPool> valid_spdy_session_pool_;
+
   // Initialized when we create a new SpdySession.
   base::WeakPtr<SpdySession> new_spdy_session_;